diff options
authorAlan Coopersmith <>2014-04-25 23:01:48 -0700
committerAlan Coopersmith <>2014-05-12 23:31:23 -0700
commit05c8020a49416dd8b7510cbba45ce4f3fc81a7dc (patch)
parent2f5e57317339c526e6eaee1010b0e2ab8089c42e (diff)
CVE-2014-0209: integer overflow of realloc() size in lexAlias()
lexAlias() reads from a file in a loop. It does this by starting with a 64 byte buffer. If that size limit is hit, it does a realloc of the buffer size << 1, basically doubling the needed length every time the length limit is hit. Eventually, this will shift out to 0 (for a length of ~4gig), and that length will be passed on to realloc(). A length of 0 (with a valid pointer) causes realloc to free the buffer on most POSIX platforms, but the caller will still have a pointer to it, leading to use after free issues. Reported-by: Ilja Van Sprundel <> Signed-off-by: Alan Coopersmith <> Reviewed-by: Adam Jackson <> Reviewed-by: Matthieu Herrb <>
1 files changed, 4 insertions, 0 deletions
diff --git a/src/fontfile/dirfile.c b/src/fontfile/dirfile.c
index cb28333..38ced75 100644
--- a/src/fontfile/dirfile.c
+++ b/src/fontfile/dirfile.c
@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group.
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
+#include <limits.h>
static Bool AddFileNameAliases ( FontDirectoryPtr dir );
static int ReadFontAlias ( char *directory, Bool isFile,
@@ -376,6 +377,9 @@ lexAlias(FILE *file, char **lexToken)
int nsize;
char *nbuf;
+ if (tokenSize >= (INT_MAX >> 2))
+ /* Stop before we overflow */
+ return EALLOC;
nsize = tokenSize ? (tokenSize << 1) : 64;
nbuf = realloc(tokenBuf, nsize);
if (!nbuf)